Subprocessors
These companies process data so RemoveMyTracks can run. We do not sell your information to them. This is not a complete corporate org chart — it is the processors that handle customer or catalog data to do a job. Details on Privacy and how we use AI.
Each one publishes how they encrypt. The pattern is TLS while data is moving, and AES-256 (or the equivalent they name) on disk. That is not end-to-end encryption. They can still decrypt what they process to do the job. If they could not, the letter would not send, the license would not be read, and you would not log in. People there are not meant to sit and read customer files. They can still technically access the data, which is why they are listed. The encryption line under each name is what they say, not a slogan we invented.
Vendors we write on your behalf (Spokeo, Ford, Bombora, and the rest of the catalog) are not subprocessors. They are the companies you asked us to contact. We send them the name and email you chose for the letters.
We do not use Google Analytics, Meta Pixel, or other advertising tags. Marketing fonts are hosted with the app. Anonymous plan-click and page-view counts on public pages are stored in our own database (Supabase), not a tracker's. Google Search Console, if enabled, only verifies that we own the domain so public pages can be indexed.
Supabase
Why: Database, login, and private file storage
What they may see: Account, profile, company list, email log, optional license photos (deleted within 30 days), signatures
Encryption (their words): They publish AES-256 at rest and TLS in transit. That is disk and pipe encryption. Our servers still read your row to send letters. One customer cannot read another's records (row-level access). Supabase security.
Vercel
Why: Hosts the website and scheduled jobs
What they may see: Request logs, the application itself
Encryption (their words): They publish AES-256 at rest and HTTPS/TLS 1.3 in transit. That is the host, not end-to-end encryption of your file. Vercel compliance.
Postmark
Why: Sends and receives privacy-request email
What they may see: Message content, delivery events, the addresses we write to
Encryption (their words): API and SMTP use TLS. They publish 2048-bit RSA on cold storage. They also say they do not encrypt email bodies on their servers, because the message has to be readable in their interface, and staff may view messages for abuse review. A letter through Postmark is not end-to-end encrypted. Postmark security FAQ.
xAI
Why: Reads license photos, classifies vendor replies, researches unknown companies, writes vendor dossiers, suggests replacement privacy URLs
What they may see: License image at extract time; vendor reply subject and body for classification; company names and public pages for catalog work
Encryption (their words): TLS in transit. By default they store the API request and response encrypted at rest for 30 days for abuse audit, then delete it. They do not train on API data without permission. The model sees the payload while it runs. xAI API security FAQ.
Have I Been Pwned
Why: Published-breach lookup for emails you list
What they may see: The emails you chose to scan - not a dark-web crawl. We send the address over HTTPS. (They also offer a k-anonymity hash search; we do not use that path yet.)
Encryption (their words): HTTPS to their API. They receive the email we look up. That is a lookup, not a vault they encrypt for us. HIBP API.
Stripe
Why: Payment
What they may see: Customer and subscription IDs. Card numbers stay with Stripe - we never see the PAN.
Encryption (their words): They publish AES-256 at rest and TLS 1.2+ in transit. Card numbers sit in a separate vault; decryption keys are on separate machines. PCI Level 1. Their "end-to-end" wording is for card terminals, not our Checkout. Stripe security.
NeverBounce
Why: Checks whether a vendor privacy mailbox can receive mail
What they may see: Catalog vendor addresses only — not your personal inbox
Encryption (their words): ZoomInfo (parent) publishes AES-256 at rest and TLS 1.2+ in transit for customer data. ZoomInfo security overview.
Changes
If this list changes in a material way, we will update the date above. Questions: privacy@removemytracks.com.